Liveness oracle tri-state: distinguish "IdP unreachable" from "departed" (powers the outage warn box + disabled actions) #650

New issue

Closed

opened 2026-09-22 22:17:08 +00:00 by Cordy · 0 comments

Cordy commented

2026-09-22 22:17:08 +00:00

Owner

Follow-up from the #597 tab rev-2 mockup review. The rev-2 mockup wants two things the current API cannot express:

The Departed-owners outage warn box should render only when the directory is actually unreachable, with assertive copy ("The identity provider is unreachable.") instead of the conditional "If the identity provider is unreachable…" text shipped in v0.6.244.
Transfer and Revoke actions disabled during an outage — "transfer nothing during an outage" enforced, not advisory. A frozen-by-outage share is not departed; the UI should make the wrong act impossible. (Flagged for veto on the mockup; approved with rev 2.)

Both need the oracle to answer three ways, not two: alive, gone, unknown. Today OwnersAPI.Alive is func(ctx, username) bool and the fail-frozen rule maps outages to false, so /api/v1/admin/owners/departed cannot tell an outage from a real departure — the listing balloons and the API is silent about why.

Scope:

Oracle gains a tri-state answer (or a separate Healthy() bool on the directory client — whichever is smaller; the 60s cache from live group resolution (#96) already knows when its last refresh failed).
/admin/owners/departed response gains "outage": true when the directory answer is unknown.
The serve-chokepoint freeze behaviour is UNCHANGED (fail-frozen stays fail-frozen).
ownerTransfer and ownersRevoke refuse with their own sentence during an outage (server-side guard, not just disabled buttons — the API is the boundary).
Frontend: warn box gated on outage with the assertive copy; the conditional copy stays for the non-outage directory case; action buttons disabled while outage.
Backend TDD; i18n ×4 for the assertive string.

Follow-up from the #597 tab rev-2 mockup review. The rev-2 mockup wants two things the current API cannot express: 1. The Departed-owners outage warn box should render **only when the directory is actually unreachable**, with assertive copy ("The identity provider is unreachable.") instead of the conditional "If the identity provider is unreachable…" text shipped in v0.6.244. 2. **Transfer and Revoke actions disabled during an outage** — "transfer nothing during an outage" enforced, not advisory. A frozen-by-outage share is not departed; the UI should make the wrong act impossible. (Flagged for veto on the mockup; approved with rev 2.) Both need the oracle to answer three ways, not two: `alive`, `gone`, `unknown`. Today `OwnersAPI.Alive` is `func(ctx, username) bool` and the fail-frozen rule maps outages to `false`, so `/api/v1/admin/owners/departed` cannot tell an outage from a real departure — the listing balloons and the API is silent about why. Scope: - Oracle gains a tri-state answer (or a separate `Healthy() bool` on the directory client — whichever is smaller; the 60s cache from live group resolution (#96) already knows when its last refresh failed). - `/admin/owners/departed` response gains `"outage": true` when the directory answer is unknown. - The serve-chokepoint freeze behaviour is UNCHANGED (fail-frozen stays fail-frozen). - `ownerTransfer` and `ownersRevoke` refuse with their own sentence during an outage (server-side guard, not just disabled buttons — the API is the boundary). - Frontend: warn box gated on `outage` with the assertive copy; the conditional copy stays for the non-outage directory case; action buttons disabled while `outage`. - Backend TDD; i18n ×4 for the assertive string.